An artificial intelligence-based intrusion detection method and system for power Internet of Things

Abstract

The present invention provides an artificial intelligence-based intrusion detection method and system for an electric power Internet of Things, which belongs to the technical field of Internet of Things, and specifically includes: using the analysis results of energy consumption data within a preset time period to determine the detection target of network intrusion of an electric power Internet of Things device, parsing the network access data of the detection target within the preset time period to obtain network access feature data of the detection target, and using a preset artificial intelligence model to perform intrusion detection on different detection targets to obtain suspected risk detection targets, determining the intrusion user address of the network intrusion of the suspected risk detection target, and using the distribution data of the suspected risk detection targets corresponding to different intrusion user addresses in the distribution network to determine the detection strategy of the network intrusion of the electric power Internet of Things device, thereby improving the reliability of the detection and processing of the network intrusion.

Description

Technical Field

[0001] The present invention belongs to the technical field of Internet of Things, and in particular relates to an artificial intelligence-based power Internet of Things intrusion detection method and system. Background Art

[0002] In order to ensure the reliable operation of power equipment, reliable monitoring of power equipment can be achieved through the setting of power Internet of Things devices. However, at the same time, data intrusion is inevitable during the use of power Internet of Things devices, which makes the power Internet of Things devices at risk of data leakage.

[0003] In order to realize intrusion detection of the power Internet of Things, the invention patent application CN202210518604.X "A method for intrusion detection of the power Internet of Things based on network traffic" uses an intrusion detection classification model based on RNN and CNN, so that the intrusion detection classification task can be completed on the edge IoT proxy device of the power Internet of Things with low computing resource consumption and high computing efficiency. However, the following technical problems are ignored:

[0004] Electric power Internet of Things devices are often scattered across multiple power distribution areas, which inevitably makes intrusion detection of electric power Internet of Things devices difficult. At the same time, when a network intrusion occurs, the energy consumption of the electric power Internet of Things devices will generally be abnormal to a certain extent due to changes in the amount of data processed. Therefore, if it is impossible to determine the intrusion detection strategy based on the distribution data of electric power Internet of Things devices with abnormal energy consumption, it is impossible to identify and handle the data leakage risk of electric power Internet of Things devices in the first place while ensuring the difficulty of detection and processing.

[0005] In response to the above technical problems, the present invention proposes an artificial intelligence-based power Internet of Things intrusion detection method and system. Summary of the invention

[0006] To achieve the purpose of the present invention, the present invention adopts the following technical solutions:

[0007] According to one aspect of the present invention, an artificial intelligence-based power Internet of Things intrusion detection method is provided.

[0008] An artificial intelligence-based power Internet of Things intrusion detection method specifically includes:

[0009] S1 acquires energy consumption data of the power Internet of Things device in real time, and uses the analysis results of the energy consumption data within a preset period to determine the energy consumption anomaly coefficient of the power Internet of Things device, and determines the detection target of network intrusion based on the energy consumption anomaly coefficient;

[0010] S2 determines the distribution data of the detection target in the distribution network, and when it is determined that the network intrusion risk of the distribution network meets the requirements based on the distribution data and the energy consumption anomaly coefficient of the detection target, proceeds to the next step;

[0011] S3: parsing the network access data of the detection target within a preset period of time to obtain the network access feature data of the detection target, and using a preset artificial intelligence model to perform intrusion detection on different detection targets to obtain suspected risk detection targets;

[0012] S4 determines the intrusion user address of the network intrusion of the suspected risk detection target, and determines the detection strategy of the network intrusion of the power Internet of Things device based on the distribution data of the suspected risk detection targets corresponding to different intrusion user addresses in the distribution network.

[0013] The beneficial effects of the present invention are:

[0014] Based on the distribution data of the detection targets in the distribution network and the energy consumption anomaly coefficient of the detection targets, it is determined whether the network intrusion risk of the distribution network meets the requirements. It realizes a comprehensive assessment of the network intrusion risk of the power Internet of Things devices in the distribution network from the distribution quantity of the detection targets in the distribution network and the energy consumption anomaly. It then realizes the comprehensive identification of situations with higher network intrusion risks in the distribution network, ensures the timeliness of network intrusion risk detection and processing of the distribution network in situations with higher network intrusion risks, and also lays the foundation for determining differentiated network intrusion risk detection strategies.

[0015] The detection strategy of network intrusion of power Internet of Things devices is determined based on the distribution data of suspected risk detection targets corresponding to different intrusion user addresses in the distribution network. It not only takes into account the difference in network intrusion risks caused by the difference in the number of suspected risk detection targets, but also takes into account the intrusion aggregation of power Internet of Things devices corresponding to different intrusion user addresses. It realizes the determination of network intrusion detection strategy of power Internet of Things devices from multiple angles, which not only ensures the efficiency of network intrusion detection and processing, but also ensures the reliability of detection and processing when the network intrusion risk is relatively high.

[0016] A further technical solution is that the energy consumption data of the power Internet of Things device is determined based on the monitoring results of the energy consumption monitoring device of the power Internet of Things device.

[0017] A further technical solution is that the energy consumption data of the power Internet of Things device includes the energy consumption of the power Internet of Things device at different times.

[0018] A further technical solution is that the preset time period is determined according to the energy consumption fluctuation of the power Internet of Things device, wherein the more severe the energy consumption fluctuation of the power Internet of Things device is, the longer the preset time period is.

[0019] A further technical solution is that the method for determining the energy consumption abnormality coefficient of the power Internet of Things device is:

[0020] Based on the analysis result of the energy consumption data within the preset time period, determine the energy consumption at different times within the preset time period;

[0021] Determine the time of abnormal energy consumption based on the energy consumption at different times;

[0022] The energy consumption abnormality coefficient of the power Internet of Things device is determined according to the proportion of the number of energy consumption abnormal moments.

[0023] A further technical solution is that the abnormal energy consumption moment is the moment when the energy consumption is greater than a preset energy consumption threshold.

[0024] A further technical solution is that the method for determining the suspected risk detection target is:

[0025] Based on the network access feature data of the detection target, the network access feature data is used as the output of the artificial intelligence model to determine the intrusion risk coefficients of different detection targets;

[0026] A suspected risk detection target among the detection targets is determined based on the intrusion risk coefficient.

[0027] A further technical solution is that the suspected risk detection target is a detection target whose intrusion risk coefficient is greater than a preset intrusion risk coefficient.

[0028] A further technical solution is that the address of the intruding user of the network intrusion of the suspected risk detection target is determined based on the identification result of the IP address of the intruding user.

[0029] In a second aspect, the present invention provides a computer system comprising: a memory and a processor connected in communication, and a computer program stored in the memory and capable of running on the processor, characterized in that: when the processor runs the computer program, it executes the above-mentioned artificial intelligence-based power Internet of Things intrusion detection method.

[0030] Other features and advantages will be described in the following description. The objects and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description and drawings.

[0031] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The above and other features and advantages of the present invention will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings.

[0033] Figure 1 It is a flow chart of an artificial intelligence-based intrusion detection method for power Internet of Things;

[0034] Figure 2 It is a flow chart of a method for determining an abnormal coefficient of energy consumption of a power Internet of Things device;

[0035] Figure 3 It is a flow chart of a method for determining suspected risk detection targets;

[0036] Figure 4 It is a flow chart of a method for determining a detection strategy for network intrusion of power Internet of Things devices. DETAILED DESCRIPTION

[0037] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0038] When a network intrusion occurs, the energy consumption of the power Internet of Things devices will generally be abnormal to a certain extent due to changes in the amount of data processed. Therefore, it is necessary to identify and process the power Internet of Things devices that have been invaded by the network in combination with the energy consumption data of the power Internet of Things devices.

[0039] Energy consumption anomaly coefficient: determined based on the proportion of time periods in which the energy consumption is not within the preset range. When the proportion of time periods in which the energy consumption is not within the preset range is 0.6, the energy consumption anomaly coefficient is determined to be 0.6.

[0040] The detection target of network intrusion is power Internet of Things devices with an energy consumption anomaly coefficient of no less than 0.5.

[0041] Network intrusion risk of distribution network: It is determined according to the number of detection targets and the energy consumption anomaly coefficients of the detection targets. Specifically, it is determined according to the weighted sum of the energy consumption anomaly coefficients of the detection targets. Specifically, if the energy consumption anomaly coefficients of different detection targets are 0.6, 0.7, and 0.8, then the network intrusion risk is (0.6+0.7+0.8) multiplied by the preset weight coefficient 0.1, which equals 0.21.

[0042] When the network intrusion risk is between 0.1 and 0.4, it is determined that the network intrusion risk of the distribution network meets the requirements.

[0043] Suspected risk detection targets: The network access feature data of the detection target is used as input, and the risk coefficient of the detection target is determined using any artificial intelligence model based on the BP neural network or LSTM neural network. Detection targets with a risk coefficient greater than 0.6 are regarded as suspected risk detection targets.

[0044] Detection strategy for network intrusion of power Internet of Things devices: determine the suspected risk detection targets corresponding to different intruding users based on the intruding user addresses, and determine the user intrusion risks of different intruding users by the number of suspected risk detection targets corresponding to different intruding users, determine the risky intrusion users among the intruding users based on the user intrusion risks, and determine the detection strategy for network intrusion of the power Internet of Things devices according to the number of the risky intrusion users.

[0045] When the number of risky intrusive users is within the preset range of the number of intrusive users, intrusion detection is performed only on the detection target. When the number of risky intrusive users is not within the preset range of the number of intrusive users, intrusion detection is performed on all power Internet of Things devices.

[0046] Embodiment 1 To solve the above problem, according to one aspect of the present invention, Figure 1 As shown, a method for intrusion detection of power Internet of Things based on artificial intelligence is provided, which specifically includes:

[0047] S1 acquires energy consumption data of the power Internet of Things device in real time, and uses the analysis results of the energy consumption data within a preset period to determine the energy consumption anomaly coefficient of the power Internet of Things device, and determines the detection target of network intrusion based on the energy consumption anomaly coefficient;

[0048] Furthermore, the energy consumption data of the power Internet of Things device is determined based on the monitoring results of the energy consumption monitoring device of the power Internet of Things device.

[0049] It can be understood that the energy consumption data of the power Internet of Things device includes the energy consumption of the power Internet of Things device at different times.

[0050] It should be noted that the preset time period is determined based on the energy consumption fluctuation of the power Internet of Things device. The more severe the energy consumption fluctuation of the power Internet of Things device is, the longer the preset time period is.

[0051] Further, such as Figure 2 As shown, the method for determining the energy consumption abnormality coefficient of the power Internet of Things device is:

[0052] Based on the analysis result of the energy consumption data within the preset time period, determine the energy consumption at different times within the preset time period;

[0053] Determine the time of abnormal energy consumption based on the energy consumption at different times;

[0054] The energy consumption abnormality coefficient of the power Internet of Things device is determined according to the proportion of the number of energy consumption abnormal moments.

[0055] It can be understood that the abnormal energy consumption moment is the moment when the energy consumption is greater than a preset energy consumption threshold.

[0056] It should also be noted that the detection target of the network intrusion is the power Internet of Things device whose energy consumption abnormality coefficient is greater than the preset abnormality coefficient.

[0057] It should also be noted that the method for determining the energy consumption abnormality coefficient of the power Internet of Things device is:

[0058] Based on the analysis result of the energy consumption data within the preset time period, determine the energy consumption at different times within the preset time period;

[0059] Determine the abnormal time of energy consumption change based on the change of energy consumption between different adjacent time points;

[0060] The energy consumption abnormality coefficient of the electric power Internet of Things device is determined according to the proportion of the number of abnormal energy consumption change moments.

[0061] Optionally, a method for determining the energy consumption anomaly coefficient of the power Internet of Things device is as follows:

[0062] Based on the analysis result of the energy consumption data in the preset time period, the energy consumption at different times in the preset time period is determined, and the deviation between the energy consumption at different times and the energy consumption at different times on different adjacent dates is determined according to the energy consumption at different times. When it is determined by using the deviation that there is no deviation date at different times:

[0063] When it is determined that there is no abnormal energy consumption change moment based on the energy consumption change between different adjacent moments:

[0064] It is determined that the power Internet of Things device is not a detection target for network intrusion;

[0065] When there is an abnormal change in energy consumption:

[0066] Obtaining the number of abnormal energy consumption change moments, and when the number of abnormal energy consumption change moments is within a preset change moment number interval: determining that the power Internet of Things device does not belong to the detection target of network intrusion;

[0067] Determine the deviation date of different time according to the deviation amount of energy consumption at different time with different adjacent dates, and when it is determined that there is no energy consumption deviation time based on the number of the deviation dates:

[0068] When it is determined that there is no abnormal energy consumption change moment based on the energy consumption change between different adjacent moments:

[0069] It is determined that the power Internet of Things device is not a detection target for network intrusion;

[0070] When there is an abnormal change in energy consumption:

[0071] Obtaining the number of abnormal energy consumption change moments, and when the number of abnormal energy consumption change moments is within a preset change moment number interval: determining that the power Internet of Things device does not belong to the detection target of network intrusion;

[0072] When the number of abnormal energy consumption change moments is not within the preset change moment number range or there is an energy consumption deviation moment:

[0073] Determine the energy consumption variation abnormality coefficient by using the number ratio of the energy consumption variation abnormality moments, determine the energy consumption deviation moment based on the number of the deviation dates, and determine the basic energy consumption abnormality coefficient based on the number ratio of the energy consumption abnormality moments;

[0074] When both the energy consumption change abnormal coefficient and the basic energy consumption abnormal coefficient meet the requirements, it is determined that the power Internet of Things device does not belong to the detection target of network intrusion;

[0075] When any one of the energy consumption variation abnormal coefficient and the basic energy consumption abnormal coefficient does not meet the requirements: the energy consumption abnormal coefficient of the electric power Internet of Things device is determined based on the basic energy consumption abnormal coefficient and the energy consumption variation abnormal coefficient.

[0076] S2 determines the distribution data of the detection target in the distribution network, and when it is determined that the network intrusion risk of the distribution network meets the requirements based on the distribution data and the energy consumption anomaly coefficient of the detection target, proceeds to the next step;

[0077] Furthermore, the adjacent dates are dates within a preset divided time period.

[0078] Specifically, the distribution data of the detection target in the power distribution network includes distribution positions of different power distribution areas in the power distribution network.

[0079] It is understandable that determining whether the network intrusion risk of the distribution network meets the requirements specifically includes:

[0080] Determining the number of detection targets in the distribution network based on the distribution data of the detection targets in the distribution network;

[0081] Normalizing the energy consumption anomaly coefficients of different detection targets to obtain normalized corrected anomaly coefficients of different detection targets;

[0082] The network intrusion risk coefficient of the distribution network is determined by the sum of the corrected abnormal coefficients of different detection targets, and based on the network intrusion risk coefficient, it is determined whether the network intrusion risk of the distribution network meets the requirements.

[0083] Further, when the network intrusion risk coefficient is not within a preset risk coefficient range, it is determined that the network intrusion risk of the distribution network does not meet the requirements.

[0084] It should also be noted that determining that the network intrusion risk of the distribution network meets the requirements specifically includes:

[0085] Based on the distribution data of the detection target in the distribution network, determine the distribution network area where the detection target exists in the distribution network, and use it as a suspected problem area;

[0086] Normalizing the energy consumption anomaly coefficients of different detection targets to obtain normalized corrected anomaly coefficients of different detection targets;

[0087] The regional risk coefficients of different suspected problem areas are determined based on the sum of the corrected anomaly coefficients of different detection targets in different suspected problem areas, and the regional risk coefficients are used to determine the screened problem areas in the suspected problem areas. The number of screened problem areas is used to determine whether the network intrusion risk of the distribution network meets the requirements.

[0088] Furthermore, the screening problem area in the suspected problem area is determined based on whether the regional risk coefficient is greater than a preset risk coefficient threshold.

[0089] Optionally, determining whether the network intrusion risk of the distribution network meets the requirements specifically includes:

[0090] S21 determines the distribution network area where the detection target exists in the distribution network based on the distribution data of the detection target in the distribution network, and regards it as a suspected problem area;

[0091] Optionally, the above step S21 includes steps S211-S212, which are specifically:

[0092] S211 determines the distribution network area where the detection target exists in the distribution network based on the distribution data of the detection target in the distribution network, and uses it as the suspected problem area. When the number of suspected problem areas does not meet the requirement, it proceeds to step S212. When the number of suspected problem areas meets the requirement, it proceeds to step S22.

[0093] S212 When the number of detection targets in the distribution network is within the preset detection target number range, it is directly determined that the network intrusion risk of the distribution network does not meet the requirements; when the number of detection targets in the distribution network is not within the preset detection target number range, proceed to step S22.

[0094] S22 normalizes the energy consumption anomaly coefficients of different detection targets to obtain normalized corrected anomaly coefficients of different detection targets, and determines the regional risk coefficients of different suspected problem areas based on the sum of the corrected anomaly coefficients of different detection targets in different suspected problem areas;

[0095] S23 determines the network intrusion risk coefficient of the distribution network by using the regional risk coefficients of different suspected problem areas, and determines whether the network intrusion risk of the distribution network meets the requirements based on the network intrusion risk coefficient.

[0096] In another embodiment:

[0097] Optionally, before entering step S21, the following steps are further included:

[0098] S201 obtains the number of detection targets in the distribution network. When the number of detection targets in the distribution network does not meet the requirement, it can be directly determined that the network intrusion risk of the distribution network does not meet the requirement. When the number of detection targets in the distribution network meets the requirement, proceed to step S202;

[0099] S202 determines the number of detection targets within a preset energy consumption abnormality coefficient range based on the energy consumption abnormality coefficients of different detection targets. When the number of detection targets within the preset energy consumption abnormality coefficient range does not meet the requirements, it can be directly determined that the network intrusion risk of the distribution network does not meet the requirements. When the number of detection targets within the preset energy consumption abnormality coefficient range meets the requirements, proceed to step S21.

[0100] Optionally, the above step S22 includes the following steps:

[0101] Normalizing the energy consumption anomaly coefficients of different detection targets to obtain normalized corrected anomaly coefficients of different detection targets, and determining the regional risk coefficients of different suspected problem areas based on the sum of the corrected anomaly coefficients of different detection targets in different suspected problem areas;

[0102] S221 obtains the number of detection targets in different suspected problem areas. When the number of detection targets is greater than the number of suspected problem areas whose number is a preset target number threshold and does not meet the requirement, it is directly determined that the network intrusion risk of the distribution network does not meet the requirement. When the number of detection targets is greater than the number of suspected problem areas whose number is a preset target number threshold and meets the requirement, proceeds to step S222;

[0103] S222 normalizes the energy consumption anomaly coefficients of different detection targets to obtain normalized corrected anomaly coefficients of different detection targets, and determines the regional risk coefficients of different suspected problem areas based on the sum of the corrected anomaly coefficients of different detection targets in different suspected problem areas;

[0104] S223 When the number of suspected problem areas whose regional risk coefficient is greater than the preset regional risk coefficient threshold does not meet the requirements, it is directly determined that the network intrusion risk of the distribution network does not meet the requirements; when the number of suspected problem areas whose regional risk coefficient is greater than the preset regional risk coefficient threshold meets the requirements, proceed to step S23.

[0105] S3: parsing the network access data of the detection target within a preset period of time to obtain the network access feature data of the detection target, and using a preset artificial intelligence model to perform intrusion detection on different detection targets to obtain suspected risk detection targets;

[0106] Specifically, Figure 3 As shown, the method for determining the suspected risk detection target is:

[0107] Based on the network access feature data of the detection target, the network access feature data is used as the output of the artificial intelligence model to determine the intrusion risk coefficients of different detection targets;

[0108] A suspected risk detection target among the detection targets is determined based on the intrusion risk coefficient.

[0109] Furthermore, the suspected risk detection target is a detection target whose intrusion risk coefficient is greater than a preset intrusion risk coefficient.

[0110] S4 determines the intrusion user address of the network intrusion of the suspected risk detection target, and determines the detection strategy of the network intrusion of the power Internet of Things device based on the distribution data of the suspected risk detection targets corresponding to different intrusion user addresses in the distribution network.

[0111] It should be noted that the address of the intruding user of the network intrusion of the suspected risk detection target is determined based on the identification result of the IP address of the intruding user.

[0112] It is understandable that if Figure 4 As shown, the method for determining the detection strategy of the network intrusion of the power Internet of Things device is:

[0113] Determining suspected risk detection targets corresponding to different intruding users based on the intruding user addresses, and determining user intrusion risks of different intruding users according to the number of suspected risk detection targets corresponding to different intruding users;

[0114] Based on the user intrusion risk, risky intrusion users among the intrusion users are determined, and a detection strategy for network intrusion of the power Internet of Things device is determined according to the number of risky intrusion users.

[0115] Furthermore, the network intrusion detection strategy of the power Internet of Things device is determined according to the number of risky intrusion users, specifically including:

[0116] When the number of risky intrusion users is within a preset intrusion user number range, intrusion detection is only performed on the detection target;

[0117] When the number of risky intruding users is not within the preset intruding user number range, intrusion detection is performed on all power Internet of Things devices.

[0118] Optionally, the method for determining the detection strategy of the network intrusion of the power Internet of Things device includes steps S41-S43, specifically:

[0119] S41 determines suspected risk detection targets corresponding to different intrusion users based on the intrusion user addresses, and determines the screened intrusion users among the intrusion users according to the number of suspected risk detection targets;

[0120] Optionally, the above step S41 includes steps S411-S413, which are specifically:

[0121] S411 obtains the number of the suspected risk detection targets. When the number of the suspected risk detection targets is greater than the preset number of risk targets, intrusion detection is performed on all power Internet of Things devices. When the number of the suspected risk detection targets is not greater than the preset number of risk targets, the process proceeds to step S412;

[0122] S412 determines the suspected risk detection targets corresponding to different intrusion users based on the intrusion user address, and when it is determined that there is no intrusion user to be screened according to the number of suspected risk detection targets, then proceeds to step S413; when there is a screened intrusion user among the intrusion users, then proceeds to step S42;

[0123] S413: When the number of the suspected risk detection targets is less than the preset number threshold, intrusion detection is only performed on the detection targets; when the number of the suspected risk detection targets is not less than the preset number threshold, the process proceeds to step S42.

[0124] Optionally, before entering step S42, it is also necessary to determine whether the number of screened intrusive users meets the requirements. When the number of screened intrusive users does not meet the requirements, intrusion detection is performed on all power Internet of Things devices. When the number of screened intrusive users meets the requirements, proceed to step S42.

[0125] S42 determines the user intrusion risks of different screened intrusion users by the number of suspected risk detection targets corresponding to different screened intrusion users and the distribution network area where the suspected risk detection targets are located;

[0126] S43 determines a comprehensive intrusion risk coefficient based on the user intrusion risks of different screened intrusion users, and determines a network intrusion detection strategy for the power Internet of Things device according to the comprehensive intrusion risk coefficient.

[0127] It should also be noted that the above step S42 includes steps S421-S423, which are specifically:

[0128] S421 determines the screened intrusion users whose number of suspected risk detection targets is greater than the preset detection target number threshold according to the number of suspected risk detection targets corresponding to different screened intrusion users. When the number of screened intrusion users whose number of suspected risk detection targets is greater than the preset detection target number threshold does not meet the requirement, intrusion detection is performed on all power Internet of Things devices. When the number of screened intrusion users whose number of suspected risk detection targets is greater than the preset detection target number threshold meets the requirement, the process proceeds to step S422.

[0129] S422 determines the user intrusion risks of different screened intrusion users by the number of suspected risk detection targets corresponding to different screened intrusion users and the distribution network area where the suspected risk detection targets are located. When the user intrusion risks of different screened intrusion users are all within the intrusion risk interval, intrusion detection is only performed on the detection targets. When there is a screened intrusion user whose user intrusion risk is not within the intrusion risk interval, step S423 is entered;

[0130] S423: When the number of screened intrusive users whose intrusion risk is not within the intrusion risk interval does not meet the requirement, intrusion detection is performed on all power Internet of Things devices. When the number of screened intrusive users whose intrusion risk is not within the intrusion risk interval meets the requirement, proceed to step S43.

[0131] Embodiment 2 In a second aspect, the present invention provides a computer system, comprising: a memory and a processor connected in communication, and a computer program stored in the memory and capable of running on the processor, characterized in that: when the processor runs the computer program, it executes the above-mentioned artificial intelligence-based power Internet of Things intrusion detection method.

[0132] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment, and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0133] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0134] The above description is only one or more embodiments of this specification and is not intended to limit this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of this specification shall be included in the scope of the claims of this specification.

Claims

1. An artificial intelligence-based power Internet of Things intrusion detection method, characterized in that: Specifically include: Acquire energy consumption data of the power Internet of Things device in real time, and use the analysis results of the energy consumption data within a preset period to determine the energy consumption anomaly coefficient of the power Internet of Things device, and determine the detection target of network intrusion based on the energy consumption anomaly coefficient; Determine the distribution data of the detection target in the distribution network, and when it is determined that the network intrusion risk of the distribution network meets the requirements based on the distribution data and the energy consumption anomaly coefficient of the detection target, proceed to the next step; The network access data of the detection target within a preset time period is analyzed to obtain the network access feature data of the detection target, and a preset artificial intelligence model is used to perform intrusion detection on different detection targets to obtain suspected risk detection targets; Determine the intrusion user address of the network intrusion of the suspected risk detection target, and determine the detection strategy of the network intrusion of the power Internet of Things device based on the distribution data of the suspected risk detection targets corresponding to different intrusion user addresses in the distribution network; The method for determining the energy consumption abnormality coefficient of the power Internet of Things device is: Based on the analysis result of the energy consumption data within the preset time period, determine the energy consumption at different times within the preset time period; Determine the time of abnormal energy consumption based on the energy consumption at different times; Determine the energy consumption abnormality coefficient of the power Internet of Things device according to the proportion of the number of energy consumption abnormal moments; Determine that the network intrusion risk of the distribution network meets the requirements, specifically including: Determining the number of detection targets in the distribution network based on the distribution data of the detection targets in the distribution network; Normalizing the energy consumption anomaly coefficients of different detection targets to obtain normalized corrected anomaly coefficients of different detection targets; Determine the network intrusion risk coefficient of the distribution network by summing the corrected abnormal coefficients of different detection targets, and determine whether the network intrusion risk of the distribution network meets the requirements based on the network intrusion risk coefficient; The method for determining the detection strategy of the network intrusion of the power Internet of Things device is: Determining suspected risk detection targets corresponding to different intruding users based on the intruding user addresses, and determining user intrusion risks of different intruding users according to the number of suspected risk detection targets corresponding to different intruding users; Determine risky intrusion users among the intrusion users based on the user intrusion risk, and determine a network intrusion detection strategy for the power Internet of Things device according to the number of risky intrusion users; The detection strategy of network intrusion of the power Internet of Things device is determined according to the number of risky intrusion users, specifically including: When the number of risky intrusion users is within a preset intrusion user number range, intrusion detection is only performed on the detection target; When the number of risky intruding users is not within the preset intruding user number range, intrusion detection is performed on all power Internet of Things devices.

2. The artificial intelligence-based power Internet of Things intrusion detection method according to claim 1, characterized in that: The energy consumption data of the power Internet of Things device is determined based on the monitoring results of the energy consumption monitoring device of the power Internet of Things device.

3. The artificial intelligence-based power Internet of Things intrusion detection method according to claim 1, characterized in that: The energy consumption data of the power Internet of Things device includes the energy consumption of the power Internet of Things device at different times.

4. The artificial intelligence-based power Internet of Things intrusion detection method according to claim 1, characterized in that: The preset time period is determined according to the energy consumption fluctuation of the power Internet of Things device, wherein the more severe the energy consumption fluctuation of the power Internet of Things device is, the longer the preset time period is.

5. The artificial intelligence-based power Internet of Things intrusion detection method according to claim 1, characterized in that: The abnormal energy consumption moment is the moment when the energy consumption is greater than a preset energy consumption threshold.

6. The artificial intelligence-based power Internet of Things intrusion detection method according to claim 1, characterized in that: The distribution data of the detection targets in the power distribution network includes distribution positions of different power distribution areas in the power distribution network.

7. The artificial intelligence-based power Internet of Things intrusion detection method according to claim 1, characterized in that: When the network intrusion risk coefficient is not within the preset risk coefficient range, it is determined that the network intrusion risk of the distribution network does not meet the requirements.

8. A computer system comprising: A memory and a processor connected in communication, and a computer program stored in the memory and capable of running on the processor, characterized in that when the processor runs the computer program, an artificial intelligence-based power Internet of Things intrusion detection method as described in any one of claims 1-7 is executed.

Images